<?php if (!defined('DASHBOARD_ROOT')) define('DASHBOARD_ROOT', realpath(__DIR__ . '/../..')); require_once DASHBOARD_ROOT . '/api/bootstrap.php'; header('Content-Type: application/json'); if ($_SERVER['REQUEST_METHOD'] !== 'POST') { exit(json_encode(['success' => false, 'error' => 'POST required'])); } CSRF::enforce(); RBAC::enforce('modify.content'); $itemId = (int)($_POST['item_id'] ?? 0); $field = trim($_POST['field'] ?? ''); $value = $_POST['value'] ?? ''; if (!$itemId || !$field) { exit(json_encode(['success' => false, 'error' => 'item_id and field required'])); } $encFields = ['product_title_enc', 'product_price_enc', 'block_config_enc']; $plainFields = ['block_type', 'slot_width', 'product_image_url']; if (in_array($field, $encFields, true)) { $encVal = Encryption::encrypt($value, 'product'); Database::execute("UPDATE order_items SET {$field} = :v WHERE id = :id", [':v' => $encVal, ':id' => $itemId]); exit(json_encode(['success' => true, 'encrypted' => true])); } elseif (in_array($field, $plainFields, true)) { Database::execute("UPDATE order_items SET {$field} = :v WHERE id = :id", [':v' => $value, ':id' => $itemId]); exit(json_encode(['success' => true])); } exit(json_encode(['success' => false, 'error' => 'Field not editable: ' . $field])); 